Cloud Linux Inc., 2318 Louis Road, Suite B, Palo Alto, CA (2026)

10/23/2026

One shell account on a shared server can be enough to reach root through a new Linux kernel flaw, wherever unprivileged user namespaces are open.

It sits in the kernel networking stack and is the same class as Dirty Pipe. A local user changes files they can only read, then climbs to root.

Who is affected: servers running an affected kernel where ordinary accounts can create user namespaces. CloudLinux 7 is not affected, and CloudLinux 10 and Ubuntu 22.04 ship with namespaces closed. On shared hosting, root reaches every tenant’s files, databases, mail, and credentials.

In our test, CageFS did not contain it: a compiled test program succeeded inside the cage.

Where it stands on 23 October: public exploit code exists, CloudLinux is not aware of any report of use in the wild, and it cannot be reached from the outside network. The upstream repair was posted for review yesterday and is not merged. There is no fixed kernel and no livepatch yet.

What to do today: run sysctl user.max_user_namespaces. A value of 0 closes the path without a reboot. The cost is that rootless Podman and Docker, unprivileged LXC, Flatpak, and some browser sandboxes stop working for ordinary accounts.

Affected versions and the full mitigation are in the advisory: https://hubs.ly/Q04Cb1sk0

If you check your fleet, tell me what you find, especially if you can’t set it to 0.

10/23/2026

“We've run it for years without an incident."

It sounds like a good reason to leave end-of-life software alone. It also gets wrong where that clean record came from.

Take MariaDB 10.6. In its five supported years, the project shipped 79 security fixes across 17 releases. The last one, in May 2026, fixed a vulnerability with a CVSS score of 10.0, the highest possible, just 40 days before end of life.

The software wasn't unusually sturdy. Someone was patching it.

When a version hits end of life, that someone stops patching it, but the software keeps running on your servers. On a shared server, one unsupported component puts every customer site that depends on it at risk.

Here’s how to check your status:

List the major components on your servers:

❗ OS
❗ Database
❗ PHP
❗ Web server
❗ OpenSSL/OpenSSH

Write down each one's end-of-life date.

For anything already past that date, or less than 12 months away, decide now: upgrade on a planned schedule, or keep it patched until you're ready.

That second option is what Endless Lifecycle Support (ELS) does. Security fixes are applied to the same version you already run and arrive through yum, dnf, or apt, so you don't have to migrate.

Check out how to stay safe while planning a proper migration: https://hubs.ly/Q04BJvJ30

Which end-of-life date is on your calendar right now?

Tell us in the comments.

10/22/2026

Most VPS pricing sheets have a blind spot: the support hours.

A hacked-site ticket on a VPS is rarely just one ticket. It’s triage, cleanup, back-and-forth with the customer, and a follow-up when it happens again.

So when you price a VPS bundle, the license line is only half the picture. Margin is what you charge, minus what you pay for licenses, minus what you spend serving the customer after the sale.

That last number is the one most spreadsheets leave out.

It can be big. Two numbers from providers running Imunify360:

➡️ HostArmada reported a 70-80% drop in hacked-website support tickets on VPS.
➡️ Esmero reported support workload down by about an hour a day.

Try this today:

1. Count last month’s hacked-site tickets.
2. Multiply by the average hours each one took, including repeat visits.
3. Multiply by your loaded hourly support cost.

That total is a real line item on every VPS you sell. Add it to your margin math.

See how the VPS program is built to take that cost down:

Learn more: https://hubs.ly/Q04BJkjw0

10/22/2026

Updating your server’s brotli package won’t fix this one.

Node.js shipped security releases on October 21, fixing 10 vulnerabilities. The most serious is an out-of-bounds write in the Brotli decoder that upstream says can allow remote code ex*****on.

On CloudLinux, Node.js Selector runs each account’s app on alt-nodejs packages, and those carry their own copy of Brotli. Only an updated alt-nodejs package closes the issue.

Where things stand:

Fixed builds for Node.js 22, 24, and 26 are rolling out. Backported builds for the end-of-life lines we ship (12, 14, 16, 18, 20, and 23) are in preparation, because upstream doesn’t patch them.

The advisory has the affected lines, the update and restart commands, and the minimum fixed release for each package:

https://hubs.ly/Q04C0wnK0

10/22/2026

AdminBolt is now an officially supported control panel for CloudLinux and Imunify360.

On a shared server, one account’s traffic spike or one compromised site should stay that account’s problem.

That takes two layers, and AdminBolt hosts can now run both:

→ LVE caps CPU, memory, I/O and processes per account, so a spike only hits the account that caused it.
→ CageFS puts each account in its own isolated filesystem, so a compromised site can’t reach its neighbors.
→ Imunify360 adds the web application firewall, malware scanning with cleanup, and brute-force protection. It runs on any AdminBolt server, with or without CloudLinux.

Setup happens from AdminBolt’s Modules page. Imunify360 installs with an activation key. CloudLinux converts AlmaLinux 9 or Rocky Linux 9 to CloudLinux 9.

The conversion is one-way and needs a reboot, so take a snapshot first and pick a quiet window.

Full details: https://hubs.ly/Q04B_8zy0

10/22/2026

A public exploit for a critical PHP bug is out, and a WAF rule is not a patch.

CVE-2026-109618 and CVE-2026-109619 are both rated Critical (CVSS v4.0: 9.2). They affect the PHP 8.2 to 8.5 branches and are classified as remote code ex*****on in PHP core. A public proof of concept already targets PHP’s session upload-progress handling of multipart requests.

Here’s what most teams miss:

▪️ A virtual patch blocks the known exploit shape. Analysts believe the underlying problem is broader than that one path, so a request that looks different may not match.

▪️ Your coverage depends on your setup. Imunify360 with the WAF enabled gets ruleset 8.83 automatically. WAF disabled, ImunifyAV/AV+, or no Imunify product gets nothing from it.

▪️ Older PHP branches are not expected to get an upstream fix at all.
What to do today:

1️⃣ Check your ModSecurity ruleset version. If it’s older than 8.83, run imunify360-agent update --force modsec-rules.
2️⃣ Treat the rule as a stopgap, not the fix.
3️⃣ Plan the PHP update (or a backported package) as soon as the patched releases land.

Save this for your next patch cycle. Which PHP versions are you running in production? 👇
Full breakdown: https://hubs.ly/Q04B_06z0

10/21/2026

The kernel patch was ready on Tuesday. The reboot went out Saturday night.

If you run shared hosting servers, you know the pattern. The fix installs in seconds. Then you schedule the reboot, post the customer notice, and wait. Every reboot takes every customer site on that server offline, and the “is my site down?” tickets pile up on the other side.

For kernel security fixes, the delay was never about the patch. It was about the reboot. The running kernel can’t swap itself out, so every fix waits behind a restart your customers will notice.

Check your own setup:
→ How many days pass between a kernel CVE disclosure and the reboot that closes it?
→ How many tickets land during one patch night?
→ Who on your team is awake for it?

If those answers sting, the reboot is the bottleneck, not the patching.

Rebootless patching with KernelCare applies the fix to the running kernel in memory, so your customers never see a restart. Reboots go back to what really needs one: firmware, hypervisor, and major OS upgrades.

We priced it out: off-hours labor, support load, and exposure time. It also covers what live patching does not remove.

What does a reboot cycle cost your hosting business? Tell us in the comments 👇

Full breakdown: https://hubs.ly/Q04BJdvT0

10/21/2026

Two weeks after a critical WordPress plugin flaw was fixed, 84% of the 2.6 million sites on our network running an affected version still hadn't patched.

Exploit traffic hit the morning after the fix went public.

That's the window hosting providers have to cover. And the malware that gets through is getting harder to remove. One self-healing malware campaign we tracked kept coming back. It reinstalled itself on cleaned sites, using the browsers of people still signed in to them.

On October 27, we go live with Web Hosting Talk:

- What protects WordPress sites in the weeks before they're patched
- Inside a self-healing malware campaign found on 120,000+ sites
- The layers it took to stop it, from the firewall to browser-side cleanup

45 minutes, live Q&A. Can't make it live? Register, and we'll send the recording.

👉 Save your seat: https://hubs.ly/Q04BSJg00

10/16/2026

Something's changing at CloudLinux. We'll share more soon.

10/15/2026

If you run a hosting support team, this will sound familiar: most of your tickets start in code you don't own.

That's what hosting providers told us in the 2026 Web Hosting Trends Report. 39% named customer CMS and application issues among their top support drains. Performance and security incidents tied for second at 35%.

When we asked which security problems take up the most time, the answers lined up:

→ 53%: outdated or vulnerable software, mostly WordPress plugins and themes
→ 51%: malware and ransomware
→ 40%: DDoS attacks
→ 36%: bots eating server resources
→ 34%: outbound spam and blacklisting

The top two start in customer code and stay open until the customer gets around to patching. DDoS and bots hit the infrastructure layer. Outbound spam hurts IP reputation and comes back as support tickets.

So the biggest risks sit where hosters have the least control, and support handles them anyway.

The 2027 Industry Year in Review survey by CloudLinux and is now open. Add your answers to next year's data.

Take the survey 👉 https://hubs.ly/Q04B62260

Cloud Linux Inc.

10/23/2026

10/23/2026

10/22/2026

10/22/2026

10/22/2026

10/22/2026

10/21/2026

10/21/2026

10/16/2026

10/15/2026

Address

Website

Alerts

Contact The Business

Shortcuts

Share

Category

Listing takedown request